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AMENDMENTS TO THE CLAIMS 

1 . (Currently Amended) A method for verifying integrity of a computing process, 
comprising: 

determining a trait associated with the computing process; 

determining a pattern statistic associated with the trait based in part on an execution 
of the computing process in a normal conditio n, wherein determining the pattern statistic further 
comprises: 

determining consecutive data associated with the trait; 

employing a graphical representation to convert the consecutive data to a 

radius-vector; 

if the radius-vector is mature, retaining an endpoint coordinate associated with 

the radius-vector; 

determining a frequency pattern associated with the trait; and 
employing the graphical representation in part to convert the frequency pattern 
to an average directional vector ; 

determining a prototype statistic associated with the trait based in part on another 
execution of the computing process in another condition; 

comparing the pattern statistic to the prototype statistic; and 
if the comparison indicates abnormal behavior the computing process, performing a 
predetermined action. 

2. (Original) The method of claim 1, wherein performing the predetermined action 
further comprises performing at least one of sending an alert message, and disabling the computing 



3. (Original) The method of claim 1, wherein the trait further comprises at least one 
system level call. 
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4. (Currently Amended) The method of claim 1 , wherein determining the patt e rn 
statistic and the prototype statistic further comprises: 

determining a trend associated with the trait during execution of the computing 
process in the normal condition; and 

determining another trend associated with the trait during the other execution of the 
computing process in the other condition. 

5. (Original) The method of claim 1, wherein comparing the pattern statistic to the 
prototype statistic further comprises comparing a frequency and a consequence associated with the 
pattern statistic to another frequency and another consequence associated with the prototype 
statistic. 

6. (Canceled) 

7. (Currently Amended) The method of claim [[6]]1 , wherein the mature radius-vector 
further comprises satisfying a condition wherein an absolute difference between a first sequence 
error and a second sequence error is less than or equal to a predetermined value. 

8. (Currently Amended) The method of claim [[6]]L wherein employing the graphical 
representation further comprises employing a chaos game representation (CGR) plot. 

9. (Original) The method of claim 1 , wherein comparing the pattern statistic to the 
prototype statistic further comprises comparing a vector norm and angle to another vector norm and 
another angle. 

1 0. (Original) The method of claim 1 , wherein comparing the pattern statistic to the 
prototype statistic further comprises: 

determining a pattern vector associated with the pattern statistic, wherein the pattern 
vector includes a direction and length; 
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determining a prototype vector associated with the prototype statistic, wherein the 
prototype vector includes another direction and another length; 

determining a total difference between the pattern vector and the prototype vector; 

and 

if the total difference is outside a predetermined confidence level, indicating that the 
prototype statistic is associated with abnormal behavior. 

1 1 . (Currently Amended) An apparatus encoded with computer-executable components 
for determining tamper evidence of a client process, comprising: 
a transceiver arranged to receive and forward data; 

an int e rface a processor , coupled to the transceiver, [[and]] having instructions 
arranged to perform actions, including: 

determining a trait associated with the client process; 

receiving a first set of data associated with the trait based in part on execution of 
the client process in a normal condition; 

receiving a second set of data associated with the trait based in part on another 
execution of the client process in another condition; 

determining a pattern statistic associated with the first set of data,, wherein 
determining the pattern statistic further comprises: 

determining consecutive data associated with the trait; 

employing a graphical representation to convert the consecutive data to a 

radius-vector; 

if the radius- vector is mature, retaining an endpoint coordinate associated with 

the radius-vector; 

determining a frequency pattern associated with the trait; and 
employing the graphical representation to convert the frequency pattern to an 
average directional vector; 

determining a prototype statistic associated with the second set of data; 

comparing the pattern statistic to the prototype statistic; and 
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if the comparison indicates abnormal behavior of the client process, performing a 
predetermined action. 

12. (Original) The apparatus of claim 11, wherein the computer-executable components 
reside in at least one of a server, and a client. 

1 3 . (Currently Amended) The apparatus of claim 1 1 , wherein performing the 
predetermined action further comprises performing at least one of sending an alert message, and 
disabling the client process computing process . 

14. (Original) The apparatus of claim 1 1, wherein the trait further comprises at least one 
system level call. 

1 5 . (Currently Amended) The apparatus of claim 1 1 , wherein determining the patt e rn 
statistic and t he prototype statistic further comprises: 

determining a trend associated with the trait during execution of the client process in 
the normal condition; and 

determining another trend associated with the trait during the other execution of the 
client process in the other condition. 

16. (Canceled) 

17. (Currently Amended) The apparatus of claim [[16]]!!, wherein the mature radius- 
vector further comprises satisfying a condition wherein an absolute difference between a first 
sequence error and a second sequence error is less than or equal to a predetermined value. 

18. (Currently Amended) The apparatus of claim [[16]]!!, wherein employing the 
graphical representation further comprises a chaos game representation (CGR) plot. 
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1 9. (Original) The apparatus of claim 1 1 , wherein comparing the pattern statistic to the 
prototype statistic further comprises: 

determining a pattern vector associated with the pattern statistic; 
determining a prototype vector associated with the prototype statistic; 
determining a total difference between the pattern vector and the prototype vector; 

and 

if the total difference is outside a predetermined confidence level, indicating that the 
prototype statistic is associated with abnormal behavior. 



20.-22. (Canceled) 
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